Well if you just enter it in a browser you'll get a pop-up to prompt you for the user/password. My guess is your using a client where you need to embed the user/pass in the URL. For that to work you'd need to URL encode the username (@ sign specifically), then we'd need to support decoding it before we use it. Feel free to drop a bug in bugzilla if you don't see one already.

Looking for new beta users -> Co-Founder of Acompli. Previously worked at Zimbra (and Yahoo! & VMware) since 2005.